The pattern parser configuration screen is designed to help you quickly create a pattern capable of parsing your log files. If you are already familiar with conversion patterns or you have a known conversion pattern that you want to apply you can simply paste your pattern into the conversion pattern text box and click Next to continue.
However, if you are using the Parser Wizard, it is more likely that you do not already know what your conversion pattern. In this case will need a sample log entry from your log file. The sample log entry should be pasted into the appropriate text box.
With the sample log entry in place, you can begin typing your conversion pattern. As you type, the parsing progress will change to indicate which characters of the sample log entry have been processed. Also, the field value grid next to the parsing progress will be updated to show the data that has been extracted from the log entry as well as the column assigned to that data.
Alternatively - the parsing progress may show errors encountered while attempting to parse the log entry. Parsing errors are usually because of unexpected characters either in the log entry or in the conversion pattern. Pay close attention to the characters in your conversion pattern. Whitespace matters and every character is important.
Rather than typing out the conversion pattern manually a simpler technique is to simply highlight the text that you want to extract, right click, and select what the text represents.
When building a conversion pattern via text selection, it is best to work through the log entry sequentially starting with the first character. Also note that once a given field has been added, it will be disabled on the pop-up menu. In the above example you can see that the date and thread columns have already been added and therefore these commands have been disabled from the context menu.
Finally, note that when adding a custom column through the text selection method, you will need to provide a column name. The custom column command is simply a wrapper around the %S conversion specifier.